Logo
Retour à la veille

CVE-2026-73840

Publié : 13 août 2026
Modifié : 13 août 2026
Lien officiel NVD
Score CVSS
5.3
MEDIUM

Description détaillée

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Références et Patchs

https://github.com/openchoreo/openchoreo/commit/268efd9b762a3f4f72b55d9c1b13dfc55122127bhttps://github.com/openchoreo/openchoreo/commit/8af4a3fc8725fc2d8a9de9611e77278a5c48f978https://github.com/openchoreo/openchoreo/commit/f540553db7143141b73bb37fae02102e6f082a34https://github.com/openchoreo/openchoreo/pull/4239https://github.com/openchoreo/openchoreo/pull/4252https://github.com/openchoreo/openchoreo/pull/4253https://github.com/openchoreo/openchoreo/releases/tag/v1.0.3https://github.com/openchoreo/openchoreo/releases/tag/v1.1.3https://github.com/openchoreo/openchoreo/releases/tag/v1.2.0-rc.2https://github.com/openchoreo/openchoreo/security/advisories/GHSA-c5f6-2rm9-2w8g

Dernières Vulnérabilités

CVE-2026-3883

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-19756

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

VOIR DÉTAILS

CVE-2026-19753

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

VOIR DÉTAILS